
Given the bounds for label probabilities, we derive a lower bound of the adversarial label probability for each label \(i \in L(\mathbf {x})\)  and an upper bound of the adversarial label probability for each label \(j \in \lbrace 1,2,\cdots ,c\rbrace \setminus L(\mathbf {x})\) . To derive these bounds, we propose a variant of the Neyman-Pearson Lemma [1]} which enables us to consider multiple functions. In contrast, the standard Neyman-Pearson Lemma [1]} is insufficient as it is only applicable to a single function while the base multi-label classifier outputs multiple labels.
